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ABSTRACT 



Digital watermarking of audio, image, video or multimedia 
data is achieved by inserting the watermark into the percep- 
tually significant components of a decomposition of the data 
in a manner so as to be visually imperceptible. In a preferred 
method, a frequency spectral image of the data, preferably a 
Fourier transform of the data, is obtained. A watermark is 
inserted into perceptually significant components of the 
frequency spectral image. The resultant watermarked spec- 
tral image is subjected to an inverse transform to produce 
watermarked data. The watermark is extracted from water- 
marked data by first comparing the watermarked data with 
the original data to obtain an extracted watermark. Then, the 
original watermark, original data and the extracted water- 
mark are compared to generate a watermark which is ana- 
lyzed for authenticity of the watermark. 

46 Claims, 6 Drawing Sheets 
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SECURE SPREAD SPECTRUM 4. The watermark should still be retrievable if common 

WATERMARKING FOR MULTIMEDIA DATA signal processing operations are applied to the data. These 

operations include, but are not limited to digital-to-analog 

This application is a continuation of application Ser. No. ana " analog-to-digital conversion, resampling, requantization 

08/534,894, filed Sep. 28, 1995, now abandoned. 5 (including dithering and recompression) and common signal 

enhancements to image contrast and color, or audio bass and 

HELD OF THE INVENTION ^Me for example. The watermarks in image and video data 

The present invention concerns a method of digital water- should be immune from geometric image operations such as 

marking for use in audio, image, video and multimedia data rotation, translation, cropping and scaling, 

for the purpose of authenticating copyright ownership, iden- 10 5. ^ ne digital watermark method or algorithm 

drying copyright infringers or transmitting a hidden mes- should be applicable to each of the different media under 

sage. Specifically, a watermark is inserted into the percep- consideration. This is particularly useful in watermarking of 

tually most significant components of a decomposition of multimedia material. Moreover, this feature is conducive to 

the data in a manner so as to be virtually imperceptible. the implementation of video and image/video watermarking 

More specifically, a narrow band signal representing the 15 using common hardware. 

watermark is placed in a wideband channel that is the data. 6. Retrieval of the watermark should unambiguously 

BACKGROUND OF THE INVENTION identify the owner. Moreover, the accuracy of the owner 

identification should degrade gracefully during attack. Sev- 

The proliferation of digitized media such as audio, image eraI previous watermarkmg methods have been pro- 

and video is creating a need for a security system which 2Q posed L p Turner m patent number W08 q/08915 entitled 

facilitates the identification of the source of the material.The « Digita i Data Security System" proposed a method for 

need manifests itself in terms of copyright enforcement and m idenlification string mt0 a ^ audio ^ by 

identification of the source of the material. substituting the "insignificant" bits of randomly selected 

Usmg conventional cryptographic systems permits only aud i 0 samples with the bits of an identification code. Bits are 

valid keyholder access to encrypted data, but once the data 2J deemed "insignificant" if their alteration is inaudible. Such 

is encrypted, it is not possible to maintain records of its a system ^ ^ appropriate for two dimensional data such 

subsequent representation or transmission. Conventional as images, as discussed in an article by R. G. Van Schyndel 

cryptography therefore provides minimal protection against et a j entitled "A digital watermark" in Intl. Cbnf. on Image 

data piracy of the type a publisher or owner of data or Processing, vol 2, Pages 86-90, 1994. The 'Rimer method 

material is confronted with by unauthorized reproduction or 3Q may easily be circumvented. For example, if it is known that 

distribution of such data or material. me algorithm only affects the least significant two bits of a 

A digital watermark is intended to complement crypto- word, then it is possible to randomly flip all such bits, 

graphic processes. The watermark is a visible or preferably thereby destroying any existing identification code, 

an invisible identification code that is permanently embed- ^ ^tidc entitled "Assuring Ownership Rights for Digi- 

ded in the data. That is, the watermark remains with the data 35 tal Images" by G. Caronni, in Proc. Reliable IT Systems, 

after any decryption process. As used herein the terms data viS '95, 1995 suggests adding tags— small geometric 

and material will be understood to refer to audio (speech and patterns-to-digitized images at brightness levels that are 

music), images (photographs and graphics), video (movies imperceptible. While the idea of hiding a spatial watermark 

or sequences of images) and multimedia data (combinations m an image is fundamentally sound, this scheme is suscep- 

of the above categories of materials) or processed or com- ^ tible to attack by filtering and redigitization. The fainter such 

pressed versions thereof. These terms are not intended to watermarks are, the more susceptible they are to such attacks 

refer to ASCII representations of text, but do refer to text and geometric shapes provide only a limited alphabet with 

represented as an image. A simple example of a watermark whica t0 enC ode information. Moreover, the scheme is not 

is a visible "seal" placed over an image to identify the applicable to audio data and may not be robust to common 

copyright owner. However, the watermark might also con- 45 geometric distortions, especially cropping. J. Brassil et al in 

tarn additional information, including the identity of the an ^Hcle entitled "Electronic Marking and Identification 

purchaser of the particular copy of the image. An effective Techniques to Discourage Document Copying" in Proc. of 

watermark should possess the following properties: Infocom 94, pp 1278-1287, 1994 propose three methods 

1. The watermark should be perceptually invisible or its appropriate for document images in which text is common, 
presence should not interfere with the material being pro- 50 Digital watermarks are coded by: (l)vertically shifting text 
tected. lines, (2) horizontally shifting words, or (3) altering text 

2. The watermark must be difficult (preferably virtually features such as the vertical endlines of individual charac- 
impossible) to remove from the material without rendering ters. Unfortunately, all three proposals are easily defeated, as 
the material useless for its intended purpose. However, if discussed by the authors. Moreover, these techniques are 
only partial knowledge is known, e.g. the exact location of 55 restricted exclusively to images containing text. 

the watermark within an image is unknown, then attempts to An article by K. Tanaka et al entitled "Embedding Secret 

remove or destroy the watermark, for instance by adding Information into a Dithered Multi-level Image** in IEEE 

noise, should result in severe degradation in data fidelity, Military Comm. Conf., pp21 6-220, 1990 and K. Mitsui et al 

rendering the data useless, before the watermark is removed in an article entitled " Video-Steganography" in IMA Intel- 

or lost - 60 lectual Property Proc, vl, ppl87-206, 1994, describe sev- 

3. The watermark should be robust against collusion by eral watermarking schemes that rely on embedding water- 
multiple individuals who each possess a watermarked copy marks that resemble quantization noise. Their ideas hinge on 
of the data. That is, the watermark should be robust to the the notion that quantization noise is typically imperceptible 
combining of copies of the same data set to destroy the to viewers. Their first scheme injects a watermark into an 
watermarks. Also, it must not be possible for colluders to 65 image by using a predetermined data stream to guide level 
combine each of their images to generate a different valid selection in a predictive quantizer. The data stream is chosen 
watermark. so that the resulting watermark looks like quantization noise. 
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A variation of this scheme is also presented, where a . . }, {1,3,5}, for example) which are selected based on the 

watermark in the form of a dithering matrix is used to dither binary digit to be transmitted. Thus Adelson's method is 

an image in a certain way. There are several drawbacks to equivalent to watermark schemes that encode information 

these schemes. The most important is that they are suscep- into the least significant bits of the data or its transform 

tible to signal processing, especially requantization, and 5 coefficients. Adelson recognizes that the method is suscep- 

geometric attacks such as cropping. Furthermore, they ^blz t0 noise m & therefore proposes an alternative scheme 

degrade an image in the same way that predictive coding and wherein a 2x1 Hadamard transform of the digitized analog 

dithering can. signal is taken. The differential coefficient of the Hadamard 

j rn « * | . « . , r transform is offset by 0 or 1 unit prior to computing the 

In Tanaka et al, the auUiors also propose a scheme for mverse ^ ^ nd / t0 encodm / m e wa ter- 

watermarkmg facsimile data. This scheme shortens or 10 mafk ^ ^ ^ cam ^ q£ ^ ^J^y ^ 

lengthens certain runs of data in the run length code used o ^ of ^ Hadamard transform . It ^ ^ clear mat lhis 

generate the coded fax image. Tins proposal is susceptible to ch WQuld demonstrate eahanced ^ nce to noise . 

digital-to-analog and analog-to digital conversions In Furthe rmore, like ^ such least significant bit schemes, an 

parucular randomizing the least significant bit (LSB) of attacker caQ e i immate me wtenn jk b randomization, 

each pixels mtensity will completely alter the resulting .run 15 ^ 

length encoding. Tanaka et al also propose a watermarking , , , x ' ' . , ... , 

method for "color-scaled picture and video sequences". This "f a . ^'^Fr S1 f a ' withm an enhanced defimUon 

method applies the same signal transform as JPEG (DCT of I 616 ™ ,0 f n & DTV) s ^ ^ * "J^^P 

8x8 sub-blocks of an image) and embeds a watermark in the *V f * ect T of ^ ^ O^rger than 

coefficient quantization module. While being compatible 20 «»» ' of « NKC signal) and decomposmg it into three 

with existing transform coders, this scheme is quite suscep- "">*•««» ^.H for low medium and h.gh frequency 

tible to requantization and filtering and is equivalent* "T* ^TTJ ^ "J""??*? 

coding the watermark in the least significant bite of the ^^'^^^MJ^ooBO^^^Ibt 

transform coefficients. M b " d « mto M levels and the high frequency 

„ coefficients, H*. of the EDTV signal are scaled such that the 

In a recent paper, by Macq and Quisquater entitled 25 additionof the H t signal plus any noise present in the system 

.Hyp^^gy for D'SJ'fl TV ^Broadcasting- in Pioc. of the ^ less ^ the minimum separation between quantization 

IEEE, 83(6), PP 944-957, 1995 there is bnefiy discussed the levels 0nce morej me method relies Qn modiryin kast 

issue of watermarking digital images as part of a general significant bits. Presumably, the mid-range rather than low 

survey on cryptography and digital television. The authors frequencies were chosen because they are less perceptually 

provide a description of a procedure to insert a watermark significant . Irj matiaslt the method proposed in the preseot 

into the least significant bits of pixels located in the vicinity mvenU0 n modifies the most perceptually significant com- 

of image contours. Since it relies on modifications of the p0 nents of the signal 

least significant bits, the watermark is easily destroyed FinaUy.it should be noted that many, if not all, of the prior 

Further, the method is only applicable to images in that it m ^ m eoUusion 

seeks to insert the watermark into image regions that he on „ ^ , . „ . - „ . , rt 

the edge of contours. J Digimarc Corporation of Portland, Oreg., has 

__ ° , . . , „ described work referred to as signature technology for use m 

W. Bender et al in arUcle entitled "Techniques for Data identifying di gital mt eUectual property. Their method adds 

Hiding" in Proc. of SPIE, v2420, page 40, July 1995, or * maU random ^m each pixels, 

describe two watermarking schemes. The first is a statistical 4Q Addit i 0 n or subtraction is based on comparing a binary mask 

method called Patchwork Patchwork randomly chooses n 0 f N bits with the least significant bit (LSB) of each pixel, 

pairs of image points (a,, and increases the bnghtness at If the ^ fc al l0 the corresponding mask bit, then the 

a ' by °° e ™ l Whde ^respondingly decreasing the bright- random quantity ^ addedj otherwise it is subtracted. The 

ness of b,-. llie expected value of the sum of the differences wa t e rmark is extracted by first computing the difference 

of the n pairs of points is claimed to be 2n, provided certain 45 between the ori maJ and watermarke d images and then by 

statistical properties of the image are true. In particular, it is examining me sign of the differ ence, pixel by pixel, to 

assumed that all brightness levels are equally likely, that is, determine if it corresponds to the original sequence of 

intensities are uniformly distributed. However, in practice, additions/subtractions. The Digimarc technique is not based 

this is very uncommon. Moreover, the scheme may not be on direct modifications of the image spectrum and does not 

robust to randomly jittering the mtensity levels by a single 5Q make ^ of perceptual relevance. While the technique 

unit, and be extremely sensitive to geometric affine trans- ap p ears t0 be robust, it may be susceptible to constant 

formations. brightness oflsets and to attacks based on exploiting the high 

The second method is called "texture block coding", degree of local correlation present in an image. For example, 
where a region of random texture pattern found in the image randomly switching the position of similar pixels within a 
is copied to an area of the image with similar texture. 55 local neighborhood may significantly degrade the water- 
Autocorrelation is then used to recover each texture region. mark without damaging the image. 
The most significant problem with this technique is that it is i n a paper by Koch, Rindfrey and Zhao entitled "Copy- 
only appropriate for images that possess large areas of ri ght Protection for Multimedia Data", two general methods 
random texture. The technique could not be used on images f or watermarking images are described. The first method 
of text, for example. Nor is there a direct analog for audio. 60 partitions an image into 8x8 blocks of pixels and computes 

In addition to direct work on watermarking images, there the Discrete Cosine Transform (DCT) of each of these 

are several works of interest in related areas. E. H. Adelson blocks. A pseudorandom subset of the blocks is chosen and 

in U.S. Pat. No. 4,939,515 entitled "Digital Signal Encoding in each such block a triple of frequencies selected from one 

and Decoding Apparatus" describes a technique for embed- of 18 predetermined triples is modified so that their relative 

ding digital information in an analog signal for the purpose 65 strengths encode a 1 or 0 value. The 18 possible triples are 

of inserting digital data into an analog TV signal. The analog composed by selection of three out of eight predetermined 

signal is quantized into one of two disjoint ranges ({0,2,4 . frequencies within the 8x8 DCT block. The choice of the 
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eight frequencies to be altered within the DCT block appears In order to overcome this problem, the frequency domain 
to be based on the belief that middle frequencies have a of the image data or sound data may be considered as a 
moderate variance level, i.e., they have similar magnitude. communication channel, and correspondingly the water- 
This property is needed in order to allow the relative strength mark may be considered as a signal transmitted through the 
of the frequency triples to be altered without requiring a 5 channel. Attacks and intentional signal distortions are thus 
modification that would be perceptually noticeable. Unlike treated as noise from which the transmitted signal must be 
in the present invention, the set of frequencies is not chosen immune. Attacks are intentional efforts to remove, delete or 
based on any perceptual significance or relative energy otherwise overcome the beneficial aspects of the data water- 
considerations. In addition, because the variance between marking. While the present invention is intended to embed 
the eight frequency coefficients is small, one would expect 10 wat ^ rmarks m dat \ me **** methodology -cm i be applied to 
that the technique may be sensitive to noise or distortions. sendmg any type of message mrough media data. 
This is supported by the experimental results reported in the Inslead of ^coding the watermark into the least signifi- 
Koch et al paper, supra, where it is reported that the cant comrwnents of me data, the present invention considers 
"embedded labels are robust against JPEG compression for a PPlying concepts of spread spectrum communication. In 
a quality factor as low as about 50%". In contrast, the is s P read s P ectmm communications, a narrowband signal is 
method described in accordance with the teachings of the transmitted over a much larger bandwidth such that the 
present invention has been demonstrated with compression signal energy present in any single frequency is impercep- 
quality factors as low as 5 percent. uble ' In a suniUr manner > the watermark is spread over 
a ,. « i vr i i tv. . | « many frequency bins so that the energy in any single bin is 
An earlier proposal by Koch and Zhao in a paper entitled „ 7 • , «. . &J , ./* 
«t a d u « a xj'aa i • uTT I !~ ™ sma11 ^ imperceptible. Since the watermark verification 

"Toward Robust and Hidden Image Copyright Labeling 20 s *ij • i % a r.ui a 

j » » • i r r • . • r i- . process includes a prion knowledge of the locations and 

proposed not triples of frequencies but pairs of frequencies ™^„t ~t*u~ JL i *ui . * . *u 

r / ■ . j •£ „ * K . * ™™ content of the watermarks, it is possible to concentrate these 

and was again designed specifically for robustness to JPEG mn „„ „, . . i • T i , u u- u * i 

* xx *u i *u _* * * * a i manv wea * signals mto a single signal with a high signal 

compression. Nevertheless, the report states that "a lower tn ^ , T t * , , , 

,. t r , -„ . \. n i-L. ■ .< . 4 « , to-noise ratio. Destruction of such a watermark would 

quality factor will increase the likelihood that the changes ~p w u i *, a ♦ u„ aa a * 

^ J . ujjjj *u • i ■>< require noise of high amplitude to be added to every 

necessary to superimpose the embedded code on the signal 25 f re q Uencv bin 

will be noticeably visible". eq ency in. 

. , - - , L Tjr , , „ t In accordance with the teachings of the present invention, 

In a second method proposed by Koch and Zhao, a watermark is ir^erted into the perceptuaUy most significant 

designed for black and white images no frequency trans- regions of me dfUa decomposition. The watermark itself is 

form is employed. Instead, the selected blocks are modified desi ^ t0 tobe additive fandom noifiC and ^ d 

so that the relative frequency of white and black pixels lhroughout me miigCt B lacin me watermark ^ the 

encodes the final value. Both watermarking procedures are perce ptually. significant components, it is much more diffi- 

parucularly vulnerable to multiple document attacks. To cult for m attacker lo ^ more Qoise tQ me nents 

protect against this, Zhao and Koch proposed a distributed adversely affecdng the ; or other dala> It ^ the 

8x8 block of pixels created by randomly sampling 64 pixels fact mat me watermark }ooks ^ noi se and is spread 

from the image. However, the resulting DCT has no rela- throughout the image or data which makes the present 

tionship to that of the true image. ConsequenUy, one would t0 ^ similar tQ d spectrum methods 

expect such distnbuted blocks to be both sensitive to noise ^ m communications system . 

and likely to cause noticeable artifacts in the image. Spreading me watermark throughout the spectrum of an 
In summary, prior art digital watermarking techniques are ^ i ma ge ensures a large measure of security against uninten- 
not robust and the watermark is easy to remove. In addition, t i ona i or intentional attack. First, the location of the water- 
many pnor techniques would not survive common signal mark ^ not obvious. Second, frequency regions are selected 
and geometric distortions in a fashion that ensures severe degradation of the original 

SUMMARY OF THE INVENTION data foUowin g attack on me watermark. 

45 A watermark that is well placed in the frequency domain 

The present invention overcomes the limitations of the of an image or a sound track will be practically impossible 

prior art methods by providing a watermarking system that to see or hear. This will always be the case if.the energy in 

embeds an unique identifier into the perceptually significant the watermark is sufficiently small in any single frequency 

components of a decomposition of an image, an audio signal coefficient. Moreover, it is possible to increase the energy 

or a video sequence. 50 present in particular frequencies by exploiting knowledge of 

Preferably, the decomposition is a spectral frequency masking phenomena in the human auditory and visual 

decomposition. The watermark is embedded in the data's systems. Perceptual masking refers to any situation where 

perceptually significant frequency components. This is information in certain regions of an image or a sound is 

because an effective watermark cannot be located in per- occluded by perceptually more prominent information in 

ceptually insignificant regions of image data or in its fre- 55 another part of the image or sound. In digital waveform 

quency spectrum, since many common signal or geometric coding, this frequency domain (and in some cases, time/ 

processes affect these components. For example, a water- pixel domain) masking is exploited extensively to achieve 

mark located in the high frequency spectral components of low bit rate encoding of data. It is clear that both auditory 

an image is easily removed, with minor degradation to the and visual systems attach more resolution to the high energy, 

image, by a process that performs low pass filtering. The 60 low frequency, spectral regions of an auditory or visual 

issue then becomes one of how to insert the watermark into scene. Further, spectrum analysis of images and sounds 

the most significant regions of the data frequency spectrum reveals that most of the information in such data is often 

without the alteration being noticeable to an observer, i.e., a located in the low frequency regions, 

human or a machine feature recognition system. Any spec- In addition, particularly for processed or compressed data, 

tral component may be altered, provided the alteration is 65 perceptually significant need not refer to human perceptual 

small. However, very small alterations are susceptible to any significance, but may refer instead to machine perceptual 

noise present or intentional distortion. significance, for instance, machine feature recognition. 
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To meet these requirements, a watermark is proposed DETAILED DESCRIPTION 

whose structure comprises a large quantity, for instance In order to ^tier understand the advantages of the 

1000, of randomly generated numbers with a normal distri- invention, the preferred embodiment of a frequency spec- 

bution having zero mean and unity variance. A binary trum based watermarking system will be described. It is 

watermark is not chosen because it is much less robust to 5 instructive to examine the processing stages that image (or 

attacks based on collusion of several independently water- sound) data may undergo in the copying process and to 

marked copies of an image. However, generally, the water- consider the effect that such processing stages can have on 

mark might have arbitrary structure, both deterministic the data. Referring to FIG. 1, a watermarked image or sound 

and/or random, and including uniform distributions. The data 10 is transmitted 12 to undergo typical distortion or 

length of the proposed watermark is variable and can be 10 intentional tampering 14. Such distortions or tampering 

adjusted to suit the characteristics of the data. For example, includes lossy compression 16, geometric distortion 18, 

longer watermarks might be used for images that are espe- si S aal processing 20 and D/A and A/D conversion 22. After 

cially sensitive to large modifications of its spectral undergoing distortion or tampering, corrupted watermarked 

coefficients, thus requiring weaker scaling factors for indi- °. r s?™* data 24 15 transmitted 26. The process of 

vidual components. is tor™ 1551011 refe *s to the application of any source or 

, . channel code and/or of encryption techniques to the data. 

The watermark is then placed in components of the image vmt most transmission steps are information lossless, 

spectrum. These components may be chosen based on an many compress i on xhGmcs (e . g . f jp EG , MPEG, etc.) may 

analysis of those components which are most vulnerable to potentially degrade the quality of the data through irretriev- 

attack and/or which are most perceptually significant. This able loss of data _ In generalj a wa t ermarkin g melhod should 

ensures that the watermark remains with the image even 20 be to &Qy introduced b transmission or 

after common signal and geometric distortions. Modification compression algorithms 

of these spectral components results in severe image deg- ^ ^ 16 fc „ tioD (hat ^ elimi . 

radation long before the watermark itself is destroyed Of nates M irre , evant ^ „ of im £ ^ 

course, to insert the watermark, it is necessary to alter these , A t *, f .. . 

< a lllJ lIV > u t-c • \T « data * In order to preserve a watermark when undergoing 

very same coefficients. However, each modification can be 25 i - , i • i . . • 

J . , 7 ' / , ' lossy compression, the watermark is located in a perceptu- 

extremely small and, in a manner similar to spread spectrum „n..' • ,/ , „• r .u a * w * • r*u* 

' . ' , . , . ally significant region of the data. Most processing of this 

communication, a strong narrowband watermark may be t ' ° • .if ^ . • * i n 

' . f , . , , „ / type occurs in the frequency domain. Data loss usually 

distributed over a much broader image (channel) spectrum. w u<^ * t, it _ ' 

Conceptually, detection of the watermaA then proLds by £ SSiFT? TT* ^ ^ ^ 

adding all of these very small signals, whose locations are 30 T 5 ' be P 8Ced * ^ e «g^«- frequency component 

11 . ' . . ^ ' ™ " of the image (or sound) data spectrum to minimize the 

only known to the copyright owner and concentrating the adveKe J*.^ q{ , impression, 

watermark into a signal with high signal-to-noise ratio. A - 4 . 

Because the location of the watermark is only known to the , M f Te ^^ ™ lmag * m % ™<=°™te ""»ny common 

copyright holder, an attacker would have to add very much ^formations *«« ™ broadly categonzed as geometric 

more noise energy to each spectral coefficient in order to be 33 distortions or signal distortions. Geometric distortions 18 are 

confident of removing the watermark. However, this process T t0 ,m * gc v ' de ? data ' ™ d mcl " de "«* °P e l a ' 

would destroy the image. ,,ons 88 rotatlon - tri »Kl*t»°°. «=^g «nd cropping. By 

„ , . , . . , , , , , manually determining a minimum of four or nine corre- 

Preferably, a predetermined number of the largest coef- sponding po ints berween the original and the distorted 

ficients of the DCT (discrete cosine transform) (excluding walermarkj it ^ possible t0 remove any two or ffiree dimen . 

the DC term) are used. However, the choice of the DCT is w sional ^ transformation . However, an affine scaling 

not critical to the algorithm and other spectral transforms, (shrinking) of mc ^ results in a loss of ^ m me ^ 

uicluding wavelettype decompositions are also possible. In frcquency specu . al regions of me Cropping, or the 

fact, use of the FFT rather than DCT is preferable from a out ^ removal 0 f portions of an image, also results 

computational perspective. ^ m ^^Me loss of data Cropping may be a serious threat 

The invention will be more clearly understood when the to any spatially based watermark but is less likely to affect 

following description is read in conjunction with the accom- a frequency-based scheme. 

panying drawing. Common signal distortions include digital-to-analog and 

BRIEF DESCRIPTION OF THE DRAWING analog-to-digiul conversion 22, resampling, requantization 

50 including dithering and recompression, and common signal 

FIG. 1 is a schematic representation of typical common enhancements to image contrast and/or color, and audio 

processing operations to which data could be subjected; frequency equalization. Many of these distortions are non- 

FIG. 2 is a schematic representation of a preferred system Unear > and il * difficult to analyze their effect in either a 

for immersing a watermark into an image; s P atiaI or frequency based method. However, the fact that 

FIGS. 3a and 3b are flow charts of the encoding and 55 * e ™»fif » known allows many signal transfor- 

decoding of watermarks; °! atl0ns 10 be undone ' at least a PP roxunalelv - For example, 

. histogram equalization, a common non-linear contrast 

FIG. 4 is a graph of the responses of the watermark enhancement method, may be substantially removed by 

detector to random watermarks; histogram specification or dynamic histogram warping tech- 

HG. 5 is a graph of the response of the watermark 60 niques. 

detector to random watermarks for an image which is Finally, the copied image may not remain in digital form, 

successively watermarked five times; Instead> it ^ likely to be printed or M analog recording made 

FIG. 6 is a graph of the response of the watermark (analog audio or video tape). These reproductions introduce 
detector to random watermarks where five images, each additional degradation into the image data that a watermark- 
having a different watermark, and averaged together; and 65 ing scheme must be robust to. 

FIG. 7 is a schematic diagram of an optical embodiment Tampering (or attack) refers to any intentional attempt to 

of the present invention remove the watermark, or corrupt it beyond recognition. The 
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watermark must not only be resistant to the inadvertent i/-*,^ 0 * 1 ) (3) 

application of distortions. It must also be immune to inten- Equation 1 is invertible. Equations 2 and 3 are invertible 

tional manipulation by malicious parties. These manipula- wherj x ^ 0 Therefore, given X* it is possible to compute the 

tions can include combinations of distortions, and can also ia VGISC function necessary to derive W* from X and X*. 

include collusion and forgery attacks. 5 Equation 1 is not the preferred formula when the values 

FIG. 2 shows a preferred system for inserting a watermark x f vary over a wide range. For example, if x-10 6 then 

into an image in the frequency domain. Image data X(i j) adding 100 may be insufficient to establish a watermark, but 

assumed to be in digital form, or alternatively data in other if X.--10, then adding 100 will unacceptably distort the vahie. 

formats such as photographs, paintings or the like, that have Insertion methods using equations 2 and 3 are more robust 

been previously digitized by well-known methods, is subject 10 wnen encountering such a wide range of values x,-. It will 

to a frequency transformation 30, such as the Fourier trans- aIso be observed that equation 2 and 3 yield similar results 

form. A watermark signal W (k) is inserted into the fre- when aw . is small. Moreover, when x, is positive, equation 

quency spectrum components of the transformed image data 3 fe equivalent to ln^-lntx^Kxx, and may be considered 

32 applying the techniques described below. The frequency ^ an application of equation 1 when natural logarithms of 

spectrum image data including the watermark signal is is °^ al values * re ^ d *or example if [vvjil and 

subjected to an inverse frequency transform 34, resulting in a=0 - 01 .' * en J !f m § ^ U ? U ° D (2) ^"j™*" the 

watermarked image data £(i j), which may remain in digital C0 l fficien J ^ ^ h * 00 more man 1% ' 

form or be printed as an analog representation by well- f° r ^ ^cations, a single scahng parameter a may 

known methods not be best for combining all values of x ( -. Therefore, 

A - , • r r • , multiple scaling parameters a.-, . . . , cl can be used with 

After applyuig a fequency ^ransfonnaUon to image 20 revised ^ t0 3 such £ ^ ^ values 

data 30, a perceptual mask .s computed that tagWights of ^ M , rdative Bmm ^ ci h ^uch x, must be 

promment regions m the frequency spectrum capable of ^ , 0 ^ me , ^ f ^ d( ^ ment A 

Wrf ™ waterm K ark wl f thout .^"Ung percep- , va , ue fo * ^ ? ^ ^ b 

Ual fidelity. This may be performed by using knowledge of h amoun( mall J din ^ docu ' m / nt 

the perceptual significance of each frequency in the 25 A for ^ £^ ^ values 

spectrum, as discussed earher, or simply by ranking the., - f *• r. i 

f • . « . . * -w. 1 , , s based upon certain general assumptions. For example, equa- 

frequencies based on their energy. The latter method was f - <, > n _ • 7 niirfl rtf r MM ♦* 1 

\ . . « - , . & : tion 2 is a special case of the generalized equation 1, 

used in experiments described below. , , x £ t, « . 4 - ~ . ' 

*\ . . . J , t , . (x/oXy+ctfXj, for cvKxx,-. That is, equaUon 2 makes the 

In general, it is desired to place the watermark m regions reasonable assumption that a large value of X| . is less 

of the spectrum that are least affected by common signal 30 tQ additive ^ a smaU value of 

distortions and are most significant to image quality as Generally, the sensitivity of the image to different values 

perceived by a viewer, such that significant modification of ± unknown . A method of empirically estimating the 

would destroy the image fidelity. In practice these regions sensitivities is to determine the distortion caused by a 

could be experimentally identified by applying common num5er of attacks on ^ ^ For cxampk it ^ 

signal distortions to images and examining which ftequen- 35 iWe tQ ^ a d ed £)* fo m D> extract 

cies are most affected and by psychophysical studies to lQe ^responding values . _ . _ * and ^ t0 te 

identify how much each component may be modified before proportional to the deviation fc'-xj. For greater robustness, 

significant changes in the image are perceivable. ft fa {Q tfy Qther forms of distortion ^ make ^ 

The watermark signal is then inserted into these promi- proportional to the average value of \x*-xji. Instead of using 

nent regions in a way that makes any tampering create 40 tne average distortion, it is possible to use the median or 

visible (or audible) defects in the data. The requirements of maximum deviation. 

me watermark mentioned above and the distortions common Alternatively, it is possible to combine the empirical 

to copying provide constraints on the design of an electronic approach with general global assumptions regarding the 

watermark. sensitivity of the values. For example, it might be required 

In order to better understand the watermarking method, 45 that c^la, whenever x ( ^x y . This can be combined with the 

reference is made to FIGS. 3(a) and 3(6) where from each empirical approach by setting a,, according to 
document D a sequence of values X=Xj, . . . ,x„ is extracted 

40 with which a watermark W=w a , . . . ,w rt is combined 42 ^ _ ^ (v . _ v ( 

to create an adjusted sequence of values X'-x^, . . . ,x'„ 1 (y/^sv,} J J 

which is then inserted back 44 into the document in place of 50 
values X in order to obtain a watermark document D'. An 

attack of the document D', or other distortion, will produce A more sophisticated approach is to weaken the monotonic- 
a document D*. Having the original document D and the itv constraint to be robust against occasional outliers, 
document D*, a possibly corrupted watermark W* is The length of the watermark, n, determines the degree to 
extracted 46 and compared to watermark W 48 for statistical 55 which lhe watermark is spread among the relevant compo- 
analysis 50. The values W* are extracted by first extracting nenls of me ima S e dala - M me size of me watermark 
a set of values X* -x/,. . .,x„* from D* (using information increases, so does the number of altered spectral 
about D) and then generating W* from the values X* and the components, and the extent to which each component need 
values X. ^ e altered decreases for the same resilience to noise. Con- 
When combining the values X with the watermark values 60 sider watermarks of ^ form xZ-XfKxw, and a white noise 
W in step 42, scaling parameter a is specified. The scaling attack b y x /= x .' +r «> whcr c r ( . are chosen according to inde- 
parameter a determines the extent to which values W alter P endent normal distributions with standard deviation a. It is 
values X. Three preferred formulas for computing X' are: P°ssiMe to recover the watermark when a is proportional to 

a/vn. That is, quadrupling the number of components can 
65 halve the magnitude of the watermark placed into each 

x/'XfKiw, (l) component. The sum of the squares of the deviations 

■ x/Wi+cwt) (2) remains essentially unchanged. 
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In general, a watermark comprises an arbitrary sequence 
of real numbers W»w f -, . . . ,w n . In practice, each value w,- 
may be chosen independently from a normal distribution 
N(0,1), where NQi, a 2 ) with mean /* and variance o 2 or of 
a uniform distribution from {1,-1} or {0,1}. 

It is highly unlikely that the extracted mark W* will be 
identical to the original watermark W. Even the act of 
requantizing the watermarked document for transmission 
will cause W* to deviate from W. A preferred measure of the 
similarity of W and W* is 



10 



sim(W t w w ) = 



(4) 



Large values of sim (W,W*) are significant in view of the 
following analysis. Assume that the authors of document D* 
had no access to W (either through the seller or through a 
watermarked document). Then for whatever value of W* is 
obtained, the conditional distribution on w ( . will be indepen- 
dently distributed according to N(0,1). In this case, 



20 



+s4 



N{0, W • W). 



25 



Thus, sim(W,W*) is distributed according to N(0,1). Then, 
one may apply the standard significance tests for the normal 
distribution. For example, if D* is chosen independently 
from W, then it is very unlikely that sim(W,W*)>5. Note that 30 
somewhat higher values of sim (W,W*) may be needed 
when a large number of watermarks are on file. The above 
analysis required only the independence of W from W*, and 
did not rely on any specific properties of W* itself. This fact 
provides further flexibility when preprocessing W*. 

The extracted watermark W* may be extracted in several 
ways to potentially enhance the ability to extract a water- 
mark. For example, experiments on images encountered 
instances where the average value of W*, denoted E t {W*), 
differed substantially from 0, due to the effects of a dithering 
procedure. While this artifact could be easily eliminated as 
part of the extraction process, it provides a motivation for 
postprocessing extracted watermarks. As a result, it was 
discovered that the simple transformation w^kw^-E^W*) 
yielded superior values of sim (W,W*). The improved 45 
performance resulted from the decreased value of W*. W*; 
the value of W*. W was only slightly affected. 

In experiments it was frequently observed that w ; * could 
be greatly distorted for some values of i. One postprocessing 
option is to simply ignore such values, setting them to 0. 
That is, 
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if lw* I > tolerance 
0 otherwise 



55 



The goal of such a transformation is to lower W**W*. A less 
abrupt version of this approach is to normalize the W* 
values to be either -1,0 or 1, by 

This transformation can have a dramatic effect on the 
statistical significance of the result. Other robust statistical 
techniques could also be used to suppress outlier effects. 

In principle, any frequency domain transform can be used. 
In the scheme described below, a Fourier domain method is 
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used, but the use of wavelet based schemes are also useable 
as a variation. In terms of selecting frequency regions of the 
transform, it is possible to use models for the perceptual 
system under consideration. 

Frequency analysis may be performed by a wavelet or 
sub-band transform where the signal is divided into sub- 
bands by means of a wavelet or multi-resolution transform. 
The sub-bands need not be uniformly spaced. Each sub-band 
may be thought of as representing a frequency region in the 
domain corresponding to a sub-region of the frequency 
range of the signal. The watermark is then inserted into the 
sub-regions. 

For audio data, a sliding "window" moves along the 
signal data and the frequency transform (DCT, FFT, etc.) is 
taken of the sample in the window. This process enables the 
capture of meaningful information of a signal that is time 
varying in nature. 

Each coefficient in the frequency domain is assumed to 
have a perceptual capacity. That is, it can support the 
insertion of additional information without any (or with 
minimal) impact to the perceptual fidelity of the data. 

In order to place a length L watermark into an NxN image, 
the NxN FFT (or DCT) of the image is computed and the 
watermark is placed into the L highest magnitude coeffi- 
cients of the transform matrix, excluding the DC component. 
More generally, L randomly chosen coefficients could be 
chosen from the M, MIL most perceptually significant 
coefficients of the transform. For most images, these coef- 
ficients will be the ones corresponding to the low frequen- 
cies. The purpose of placing the watermark in these loca- 
tions is because significant tampering with these frequencies 
will destroy the image fidelity or perceived quality well 
before the watermark is destroyed. 

The FFT provides perceptually similar results to the DCT. 
This is different than the case of transform coding, where the 
DCT is preferred to the FFT due to its spectral properties. 
The DCT tends to have less high frequency information than 
that the FFT, and places most of the image information in the 
low frequency regions, making it preferable in situations 
where data need to be eliminated. In the case of 
watermarking, image data is preserved, and nothing is 
eliminated. Thus the FFT is as good as the DCT, and is 
preferred since it is easier to compute. 

In an experiment, a visually imperceptible watermark was 
intentionally placed in an image. Subsequently, 100 ran- 
domly generated watermarks, only one of which corre- 
sponded to the correct watermark, were applied to the 
watermark detector described above. The result, as shown in 
FIG. 4, was a very strong positive response corresponding to 
the correct watermark, suggesting that the method results in 
a very low number of false positive responses and a very low 
false negative response rate. 

In another test, the watermarked image was scaled to half 
of its original size. In order to recover the watermark, the 
image was re-scaled to its original size, albeit with loss of 
detail due to subsampling of the image using low pass spatial 
filter operations. The response of the watermark detector 
was well above random chance levels, suggesting that the 
watermark is robust to geometric distortions. This result was 
achieved even though 75 percent of the original data was 
missing from the scaled down image. 

In a further experiment, a JPEG encoded version of the 
image with parameters of 10 percent quality and 0 percent 
smoothing, resulting in visible distortions, was used. The 
results of the watermark detector suggest that the method is 
robust to common encoding distortions. Even using a ver- 
sion of the image with parameters of the 5 percent quality 
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and 0 percent smoothing, the results were well above that 
achievable due to random chance. 

In experiments using a dithered version of the image, the 
response of the watermark detector suggested that the 
method is robust to common encoding distortion. Moreover, 
more reliable detection is achieved by removing any non- 
zero mean from the extracted watermark. 

In another experiment, the image was clipped, leaving 
only the central quarter of the image. In order to extract the 
watermark from the clipped image, the missing portion of 
the image was replaced with portions from the original 
unwatermarked image. The watermark detector was able to 
recover the watermark with a response greater than random. 
When the non-zero mean was removed, and the elements of 
the watermark were binarized prior to the comparison with 
the correct watermark, the detector response was improved. 
This result is achieved even though 75 percent of the data 
was removed from the image. 

In yet another experiment, the image was printed, 
photocopied, scanned using a 300 dpi Umax PS-2400x 
scanner and rescaled to a size of 256x256 pixels. Clearly, the 
final image suffered from different levels of distortion intro- 
duced at each process. High frequency pattern noise was 
particularly noticeable. When the non-zero mean was 
removed and only the sign of the elements of the watermark 25 
was used, the watermark detector response improved to well 
above random chance levels. 

In still another experiment, the image was subject to five 
successive watermarking operations. That is, the original 
image was watermarked, the watermarked image was 30 
watermarked, and so forth. The process may be considered 
another form of attack in which it is clear that significant 
image degradation occurs if the process is repeated. FIG. 5 
shows the response of the watermark detector to 1000 
randomly generated watermarks, including the five water- 
marks present in the image. The five dominant spikes in the 
graph, indicative of the presence of the five watermarks, 
show that successive watermarking does not interfere with 
the process. 

The fact that successive watermarking is possible means 
that the history or pedigree of a document is determinable if 
successive watermarking is added with each copy. 

In a variation of the multiple watermark image, five 
separately watermarked images were averaged together to 
simulate simple conclusion attack. FIG. 6 shows the 
response of the watermark detector to 1000 randomly gen- 
erated watermarks, including the five watermarks present in 
the original images. The result is that simple collusion based 
on averaging is ineffective in defeating the present water- 
marking system. 

The result of the above experiments is that the described 
system can extract a reliable copy of the watermark from 
images that have been significantly degraded through sev- 
eral common geometric and signal processing procedures. 
These procedures include zooming (low pass filtering), 
cropping, lossy JPEG encoding, dithering, printing, photo- 
copying and subsequent rescanning. 

While these experiments were, in fact, conducted using an 
image, similar results are attainable with text images, audio 
data and video data, although attention must be paid to the 
time varying nature of these data. 

The above implementation of the watermarking system is 
an electronic system. Since the basic principle of the inven- 
tion is the inclusion of a watermark into spectral frequency 
components of the data, watermarking can be accomplished 
by other means using, for example, an optical system as 
shown in FIG. 7. 
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In FIG. 7, data to be watermarked such as an image 52 is 
passed through a spatial transform lens 54, such as a Fourier 
transform lens, the output of which lens is the spatial 
transform of the image. Concurrently, a watermark image 56 
is passed through a second spatial transform lens 58, the 
output of which lens is the spatial transfer of the watermark 
image 56. The spatial transform from lens 54 and the spatial 
transform from lens 58 are combined at an optical combiner 
60. The output of the optical combiner 60 is passed through 
an inverse spatial transform lens 62 from which the water- 
mark image 64 is present. The result is a unique, virtually 
imperceptible, watermarked image. Similar results are 
achievable by transmitting video or multimedia signals 
through the lenses in the manner described above. 

While there have been described and illustrated spread 
spectrum watermarking of data and variations and modifi- 
cations thereof, it will be apparent to those skilled in the art 
that further variations and modifications are possible without 
deviating from the broad principles and spirit of the present 
invention which shall be limited solely by the scope of the 
claims appended hereto. 

What is claimed is: 

1. A method of inserting a watermark into data comprising 
the steps of: 

obtaining a spectral decomposition of data to be water- 
marked which data is a representation of humanly 
perceivable material; 

inserting a watermark into the perceptually significant 
components of the decomposition of data: and 

applying an inverse transform to the decomposition of 
data with the watermark for generating watermarked 
data. 

2. A method of inserting a watermark into data as set forth 
in claim 1, where said data comprises image data. 

3. A method of inserting a watermark into data as set forth 
in claim 1, where said data comprises video data. 

4. A method of inserting a watermark into data as set forth 
in claim 1, where said data comprises audio data. 

5. A method of inserting a watermark into data as set forth 
in claim 1, where said data comprises multimedia data. 

6. A method of inserting a watermark into data as set forth 
in claim 1, where said obtaining a spectral decomposition of 
data is selected from the group consisting of Fourier 
transformation, discrete cosine transformation, Hadamard 
transformation, and wavelet, multi-resolution, sub-band 
method. 

7. A method of inserting a watermark into data as set forth 
in claim 6, where said inserting a watermark inserts water- 
mark values where addition of additional signal into a 
perceptually significant component affects the perceived 
quality of the data. 

8. A method of inserting a watermark into data as set forth 
in claim 1, further comprising: 

comparing data with watermarked data for obtaining 

extracted data values; 
comparing extracted data values with watermark values 

and data for obtaining difference values; and 
analyzing difference values to determine the watermark in 

the watermarked data. 

9. The method of inserting a watermark into data as set 
forth in claim 8, wheye watermark values include associated 
scaling parameters. 

10. A method of inserting a watermark into data as set 
forth in claim 9, where scaling parameters are selected such 
that adding additional watermark value affects the perceived 
quality of the data. 
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11. A method of inserting a watermark into data as set 24. A system for inserting a watermark into data as set 
forth in claim 8, where the watermark values are chosen forth in claim 23, where said first transform lens and said 
according to a random distribution. second transform lens are Fourier transform lenses and said 

12. A method of inserting a watermark into data compris- inverse transform lens is an inverse Fourier transform lens, 
ing the steps of: 5 25. A method of inserting a watermark into data compris- 

extracting values of perceptually significant components m g the steps of: 

of a spectral decomposition of data which data is a p r0 viding a medium containing data; 

representation of human perceivable material; ... , , . . , 

combining watermark values with the extracted values to obtaining a s V tcir * 1 ^composition of data to be water- 
create adjusted values; and 10 marked, 

inserting the adjusted values into the data in place of the inserting a watermark into the perceptually significant 

extracted values to produce watermarked data. components of the decomposition of data; and 

13. The method of inserting a watermark into data as set applying an inverse transform to the decomposition of 
forth in claim 12, where watermark values include associ- data with the watermark to generate watermarked data, 
ated scaling parameters. 15 2 6. A method of inserting a watermark into data as set 

14. A method of inserting a watermark into data as set f orm [ Q daim 25, where said data comprises image data, 
forth in claim 13, where scaling parameters are selected such 2 7. A method of inserting a watermark into data as set 
that ^adding additional watermark value affects the perceived forlh m claim 25j whcrc ^ dala uprises video data. 

quality ot the data 28. A method of inserting a watermark into data as set 

15. A method of inserting a watermark into data as set • , • ^- „ , _ -j , . • o , . 

forth in claim 12, where the watermark values are chosen 20 7 T composes audio data, 

according to a random distribution. , 2 ? . metho * ° f 1 f crtu « * * atennark mt0 f l 

16. A method of inserting a watermark into data as set J* m claim where said data comprises mulUmedia 
forth in claim 12, further comprising: 

comparing data with watermarked data for obtaining , 3 ? . A method °f inserting a watermark into data as set 
extracted data values- 25 forth 111 claun 2 s . where said obtaining a spectral decom- 
comparing extracted data values with watermark values ° f d f a,a *.* le . cted f «n the group consisting of 
and data for obtaining difference values; and Founer transformaUon, discrete cosine transformanon, Had- 
. . j.« * * j * i_ i . amard transformation, and wavelet, multi-resolution, sub- 
analyzing difference values to determine the watermark in band method 

the watermarked data^ 30 31. A method of inserting a watermark into data as set 

17. Jne method of inserting a watermark into data as set fonh m daim ^ wherc ^ insertin a walermark inserts 
forth m claim 16, where watermark values include associ- watermark values where addition of additional signal mt0 a 
ate sea g parameters perceptually significant component affects the perceived 

18. A method of inserting a watermark into data as set quality of tie data 

forth in claim 1 12 .where scaling parameter are selected such 32 A memod of ^ a watennark ^ ^ „ set 

mat adding additional watermark value affects the perceived forth . clajm 25 further OTmprising . 

quality of the data. * & 

19. A method of inserting a watermark into data as set comparing data with watermarked data for obtaining 
forth in claim 16, where the watermark values are chosen extracted data values; 

according to a random distribution. comparing extracted data values with watermark values 

20. A method of inserting a watermark into data as set 40 data for obtaining difference values; and 

forth in claim 16, further comprising the step of preprocess- analyzing difference values to determine the watermark in 

ing distorted or tampered watermarked data before said the watermarked data. 

comparing data. 33. The method of inserting a watermark into data as set 

21. A method of inserting a watermark into data as set forth in claim 32, where watermark values include associ - 
forth in claim 20, where said distorted or tampered water- 45 ated scaling parameters. 

marked data is clipped data and said preprocessing com- 34. A method of inserting a watermark into data as set 

prises replacing missing portions of the data with cone- forth in claim 33, where scaling parameters are selected such 

sponding portions from original unwatermarked data; that adding additional watermark value affects the perceived 

22. A method of inserting a watermark into data as set quality of the data. 

forth in claim 12, where said combining watermark values 50 35. A method of inserting a watermark into data as set 

sequentially combines watermark values for a plurality of forth in claim 32, where the watermark values are chosen 

watermarks. according to a random distribution. 

23. A system for inserting a watermark into data com- 36. A method of inserting a watermark into data compris- 
prising: ing the steps of: 

providing image data; providing a medium containing data; 

providing watermark data; extracting values of perceptually significant components 

first transform lens for transforming image data passing of a spectral decomposition of the data; 

therethrough into transformed image data; combining watermark values with the extracted values to 

second transform lens for transforming watermark data 60 create adjusted values; and 

passing therethrough into transformed watermark data; inserting the adjusted values into the data in place of the 

optical combiner for combining the transformed image extracted values to produce watermarked data. 

data and the transformed watermark data to form 37. The method of inserting a watermark into data as set 

transformed watermarked data; and forth in claim 36, where watermark values include associ - 

inverse transform lens for forming watermarked data by 65 ated scaling parameters, 

inverse transformation of transformed watermarked 38. A method of inserting a walermark into data as set 

data. forth in claim 37, where scaling parameters are selected such 
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that adding additional watermark value affects the perceived 43. A method of inserting a watermark into data as set 

quality of the data. forth in claim 40, where the watermark values are chosen 

39. A method of inserting a watermark into data as set according to a random distribution. 

forth in claim 36, where the watermark values are chosen 44 A melhod of inserting a wat ermark into data as set 

accordmgtoarandomd^ution. 5 forth m ^ ^ ^ me st of p rcproccss . 

40. A method of inserting a watermark into data as set .. , . . , j . • j j . £ r -j 
forth in claim 36, further comprising: mg ***** 01 Um P ered watermarked data before said 



comparing data. 



comparing data with watermarked data for obtaining A j * • , . . 

extracted data values; 45 " A method of insertm S a watennark mto ^ 35 * l 



comparing extracted data values with watermark values 



10 



forth in claim 44, where said distorted or tampered water- 



and dala for obtaining difference values; and marked da,a * cU PP ed da,a and S! » d Preprocessing com- 

. . . , , . pnses replacing missing portions of the data with corre- 

analyzing difference values to determine the watermark in . - ... 

the watermarked data sponding portions from original unwatermarked data. 

41. The method of inserting a watermark into data as set 1 _ **. A method of inserting a watermark into data as set 
forth in claim 40, where watermark values include associ- forth m claim 36 » where ^ combining watermark values 
ated scaling parameters. sequentially combines watermark values for a plurality of 

42. A method of inserting a watermark into data as set watermarks, 
forth in claim 41, where scaling parameters are selected such 

that adding additional watermark value affects the perceived 

quality of the data. * * * * * 
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